Account
—
Runs left 0

Your coding agent gets stopped at the boundary, not told about it

Write down what the project will not do. One hook stops Claude Code, Cursor, Codex, Devin Desktop (ex-Windsurf) and Copilot before the tool call runs, and names the boundary. No account, no telemetry: the log stays in your repository.

Get the guard free
or with one command npx skills add momonanq/lumis-skills --skill lumis-scope-guard --global

77 attempts to rewrite the guard through an agent: 69 refused, the other 8 named one by one. Check it yourself

LUMIS studio: the new Blueprint form, the project boundaries and the remaining runs The /guard page: the Non-Goals form and the file list of the free guard pack Public scope passport of a project: the SHA-256 signature and the check status Project list: hash lock, number of Non-Goals and of locked decisions for each

One workflow for the whole team

The hook stops an agent's tool call in the clients that load it. A pull request is where every change arrives — from any agent, in any client, and from people — so the same boundaries are checked there too.

  • Reads the lines a pull request adds. scope_guard.py check-diff judges them against .lumis/scope_guard.json as it is on the base branch; a removed line never crosses a boundary.
  • Four verdicts. BLOCK: a Non-Goal trigger in an added line of code (not a comment line), a file under a forbidden path, a change to the hook or this workflow; the job fails. WARN: a trigger in a document, a test or a comment line, a new dependency held for the reviewer, a change to the boundaries themselves. INCOMPLETE: the diff is larger than the check reads and the rest was not judged; the job fails, and it is never a PASS. PASS: none of that.
  • One report. One pull request comment, edited on the next push (seen on one live repository so far), and the job summary. Also a SARIF file for code scanning; its upload has not yet been seen on a live repository. Each finding names the boundary (NG-n), who set it, the file and line, and the trigger.
  • No model. Words, paths, packages and manifests are matched, not meaning; there is no score and no semantic judge. The checker runs from the base commit, so a pull request that rewrites the hook is not judged by its own rewrite.

LUMIS boundary check — BLOCK

3 BLOCK · 0 WARN

verdictNG-nfile:linetrigger
BLOCKNG-1billing/stripe_client.pyforbidden path 'billing/'
BLOCKNG-1billing/stripe_client.py:1forbidden dependency 'stripe'
BLOCKNG-1billing/stripe_client.py:5Non-Goal keyword 'stripe'
The report of a real run: a fresh repository with the Non-Goal “No payment collection or billing” and a branch that adds billing/stripe_client.py with import stripe. The boundary and excerpt columns are left out here.

source: docs/BOUNDARY_CHECK_CI.md, a check-diff run · 2026-09-28

Install in two steps

  1. 1python <skill-dir>/scripts/lumis_guard.py init … --ci writes .github/workflows/lumis-boundary-check.yml. The guard ZIP from /guard and the full LUMIS pack already carry it.
  2. 2Commit the workflow with .lumis/ and scripts/ to the default branch and open a pull request. To make a BLOCK stop the merge, mark “LUMIS boundary check” as a required status check in branch protection. A pull request runs its own copy of the workflow: make the check required and put the guard files (.lumis/, scripts/, the workflow) under CODEOWNERS.

It reads text, not meaning: a home-grown billing module that never says “stripe” passes. It runs after the change is written, not before the agent's call — that is the hook's job. It is a review aid, not a security boundary. Code scanning is free in public repositories and needs GitHub Advanced Security in private ones; we have not yet seen the SARIF upload reach the Security tab on a live repository.

The workflow file and the full list of what the check does not read are in the README.

Risks challenged & ruled on
8
in the RentGuard demo
source: the public RentGuard demo blueprint · run of 2026-09-03
Non-Goals locked
5
SHA-256: 0c78119843
source: the public RentGuard demo blueprint · run of 2026-09-03

An agent reads a rule in prose. A hook enforces it.

The same boundary in two shapes: a paragraph in an instruction, and a hook in the repository.

A rule in prose the agent reads it and decides
  • A boundary you can read and walk past: the ban lives in text; nothing stops the tool call.
  • No trace is left: you cannot see whether the agent went near the boundary, or how often.
  • Nothing to point at a month later: where the decision is written down, and who made it, is unknown.

Stops: nothing · no log

The boundary as a hook exit 2
  • The call is refused, not discussed: the hook exits 2 and the client does not run the command — that is what the recording below shows.
  • Every trigger lands in the log: .lumis/guard.log remembers the boundary, the agent and what it tried to do.
  • Only Amend lifts a boundary: the constitution and the hook are rebuilt together, and the decision goes into the decision log.

Five AI clients — one hook · 2 runs free

source: recording by scripts/record_block.py, agents scenario · 2026-09-07

One boundary. Five agents.
The same refusal.

The Non-Goal “no rent payment collection” becomes a hook. Claude Code, Cursor, Codex CLI, Devin Desktop (ex-Windsurf) and GitHub Copilot each get their own refusal shape and stop on exit code 2.

Checked live in Claude Code; the other four clients get the same script through their hook configs, not yet confirmed in a live client.

Diagram: the idea goes to the six AI roles of the consilium, and their rulings converge into one locked boundary contract
  1. 1You describe the idea and what the product will not do.
  2. 2Six AI roles argue it into a PRD, an architecture, a roadmap and a master prompt; a rule engine without a model checks the architecture against the Non-Goals.
  3. 3The boundaries leave for the repository as hooks: a call across a boundary is not executed, it lands in .lumis/guard.log.
rentguard — LUMIS scope guard · one hook, five agents
Claude Code › Bash: pip install stripe   (.claude/settings.json → PreToolUse)
  hook → BLOCKED (exit 2) — the tool call never runs
  ⛔ LUMIS Scope Guard blocked this change (CONSTITUTION.md, Article I — Non-Goals): forbidden dependency 'stripe', Non-Goal keyword 'stripe' → NG-1 "No rent payment collection, insurance or financial guarantees" (set by the founder; CONSTITUTION.md, Article I). The boundary can be lifted only by the founder (LUMIS Amend / a new consilium run), never by bypassing the hook.
 
… Cursor, Codex CLI, Devin Desktop (ex-Windsurf), GitHub Copilot — the same call, each client's own payload, the same exit 2 …
 
$ python scripts/scope_guard.py report
  LUMIS Scope Guard — 5 events in .lumis/guard.log
    blocked: 5 · asked: 0 · inspected: 0 · warned: 0 · drift prompts: 0 · agents: claude, codex, copilot, cursor, windsurf
Show all 5 log events 
    2026-09-09T10:16:02+00:00 blocked [claude] Bash: forbidden dependency 'stripe', Non-Goal keyword 'stripe' → NG-1 "No rent payment collection, insurance or financial guarantees" (set by the founder; CONSTITUTION.md, Article I)
    2026-09-09T10:16:02+00:00 blocked [cursor] Bash: forbidden dependency 'stripe', Non-Goal keyword 'stripe' → NG-1 "No rent payment collection, insurance or financial guarantees" (set by the founder; CONSTITUTION.md, Article I)
    2026-09-09T10:16:02+00:00 blocked [codex] Bash: forbidden dependency 'stripe', Non-Goal keyword 'stripe' → NG-1 "No rent payment collection, insurance or financial guarantees" (set by the founder; CONSTITUTION.md, Article I)
    2026-09-09T10:16:02+00:00 blocked [windsurf] Bash: forbidden dependency 'stripe', Non-Goal keyword 'stripe' → NG-1 "No rent payment collection, insurance or financial guarantees" (set by the founder; CONSTITUTION.md, Article I)
    2026-09-09T10:16:02+00:00 blocked [copilot] Bash: forbidden dependency 'stripe', Non-Goal keyword 'stripe' → NG-1 "No rent payment collection, insurance or financial guarantees" (set by the founder; CONSTITUTION.md, Article I)
Real output from scripts/scope_guard.py. The recording is made by scripts/record_block.py: it builds the same ZIP a user downloads, unpacks it and calls the hook exactly the way each client does. Nothing is drawn. Seen refusing live: Claude Code, in the founder's own repository (field log of 22.09). The other four answer the hook format their clients document; send us your client's refusal and we list it as seen live.

⚡ Instant start from a preset

Boundaries and stack are pre-filled — change them if you need to

Works with your AI IDE

The Blueprint exports into formats your editor understands without adapters.

curCursor
ccClaude Code
vsVS Code
dvnDevin Desktop (бывший Windsurf)
spkSpec-Kit
jbJetBrains
  • .cursorrules + MASTER_PROMPT.md — paste into Composer and press Generate
  • .claude/settings.json, .cursor/hooks.json — the hook stops the tool call at the boundary instead of asking the agent to remember it
  • .specify/ — compatible with GitHub Spec-Kit (constitution, spec, plan, tasks)
  • Starter repository (.zip) with a one-line CLI bootstrap

Transparent pricing

One project — one credit. No surprises.

  • No credit card
  • Free sign-up
  • First result in 5 minutes

source: end-to-end studio runs on Gemini, 2.5 and 3.5 minutes · 2026-09-03

Frequently asked questions

Is this a subscription or a one-time payment?

One-time. A pack of runs is bought once and does not renew itself: LUMIS charges nothing on a schedule. The terms are in the public offer.

What happens to my code and my data?

Your texts and files are not used to train models: the Zero Training policy is written out in the privacy policy. The guard pack runs locally in your repository, and .lumis/guard.log is never sent anywhere.

Can I get a refund?

Yes, on the terms written in the refund policy, which also says what exactly is returned and within what period.

Do I need a card for the free runs?

No. Signing up grants 1 run right away and 1 more after you confirm your e-mail; no card is asked for and no payment form opens.

Which clients stop the call instead of merely reading the rule?

Claude Code, Cursor, Codex CLI, Devin Desktop (ex-Windsurf) and GitHub Copilot — the pack writes a hook config for each, and a call past the boundary gets exit code 2. Other editors get the same boundaries as text (.cursorrules, CLAUDE.md, AGENTS.md).

source: recording by scripts/record_block.py, agents scenario · 2026-09-07

Ready to build a product
without scope creep?

Your first 2 runs are free: 1 right away, 1 after you confirm your e-mail. No card needed.